Verify your domain in AYAsec using Contabo

Add one TXT record to prove you control your domain. With Contabo, the first thing to check is whether Contabo is serving your DNS at all.

Before AYAsec scans a domain, you need to prove you control it. That is one TXT record - but with Contabo, the first question is whether the record belongs here at all.

Why we ask. Verification is what stops AYAsec from being pointed at infrastructure you do not own. A scanner that will check any domain on request is a reconnaissance tool for whoever asks, which is why the source of an asset list matters. Requiring proof of ownership is what separates a security product from a reconnaissance service.

You verify each asset once. Verifying an apex domain automatically verifies its subdomains, so verifying example.com covers api.example.com, www.example.com and the rest. New subdomains added later do not need their own record. Re-verify only if you edit the hostname or delete and re-add the asset, because the new asset has a new UUID token.

After successful verification, you can remove the record. AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you.

First: is Contabo serving your DNS?

Contabo is used most often for hosting - servers and storage - while the domain itself stays with the registrar it was bought from. In that setup, the DNS records that matter are at the registrar, and anything added at Contabo is never read.

Check your domain's nameservers before doing anything else. If they point somewhere other than Contabo, that is where this record belongs, and one of the other provider guides applies - we have them for Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, DigitalOcean, GoDaddy and Hetzner.

This one check is the difference between two minutes and a confusing afternoon.

Before you start

  • Access to the Contabo customer control panel
  • Your verification token from AYAsec
  • The Analyst role or higher in your AYAsec workspace

If someone else manages your DNS, skip to Don't have Contabo access? - there is a message you can forward.

Step 1 · Copy your token from AYAsec

Open Assets Discovery in AYAsec and open the Assets tab, or open the asset's detail page. Start verification from the Not verified pill, Verify now in the card menu, or Verify domain in the asset context menu. In the dialog titled Verify asset - , select DNS Record. Copy the two values shown:

  • Record name: _ayasec-verified.yourdomain.com (your apex domain, for example example.com, also when you verify www.example.com or another subdomain: one record verifies the apex and every subdomain)
  • Record value: the value shown in the verification dialog (it looks like ayasec-verification= followed by 32 characters)

Keep the tab open.

Verifying a whole asset group? Open Assets Discovery > Asset Groups and then open the group. Use Verify domain for a group with a source apex or Verify unverified for one without. The dialog is titled Verify domain - and says Verifying covers all N targets in this group; its action is Verify now. The record value is the same ayasec-verification= value as for a single asset, so if you already added it for this domain you do not need another record.

Step 2 · Add the TXT record in Contabo

  • Sign in to the Contabo control panel at new.contabo.com.
  • Open Network Services, then DNS Management.
  • If the zone does not exist yet, click Create DNS Zone and enter your domain in the Zone field.
  • Click the zone name, then the pencil icon under Quick Action.
  • Add a record. Contabo's fields are Name, TTL, Type and Data - *Data* is the value.

Field - What to enter

Type - TXT

Name - See the naming note below - Contabo differs from every other provider here

Data - Your token

TTL - 14400 at the lowest. See below

  • Save.

Do not look for DNS under Domains. The Domains → Domain Management menu is for registering and transferring domains. Zones and records are under Network Services → DNS Management. They are different areas of the same panel.

The Contabo minimum TTL is four hours

This is the single most important thing on this page.

Contabo's minimum allowed TTL is 14400 seconds - four hours. Most providers let you go to 300 seconds or lower; DigitalOcean allows 30. Contabo does not.

The consequence is practical and unpleasant: if you mistype the token, the wrong value can stay cached for up to four hours and there is no way to lower the TTL in advance to shorten that. Verification will keep failing on a record you have already fixed.

So on Contabo, more than anywhere else: paste the token, do not type it, and check it before saving.

dig TXT _ayasec-verified.yourdomain.com +short

Contabo recommends 86400 if you are unsure, but for a record you may need to correct, stay at the 14400 minimum.

The Name field: Contabo uses the full hostname

Every other provider in this set takes a prefix and appends your domain. Contabo's documentation shows the full hostname in the Name field - their example for a subdomain is subdomain.domain.com, not subdomain. Nor does their documentation use @ for the apex anywhere.

Their guidance is written around A records and does not state the rule for TXT specifically, so the safe approach is: enter _ayasec-verified.yourdomain.com, save, then check with dig before clicking Verify. If nothing comes back, try _ayasec-verified on its own.

It is one extra minute and it avoids a four-hour wait on a wrong record.

If your domain is registered elsewhere

Contabo supports this, though their own documentation calls it "not recommended" without explaining why.

Create the zone in DNS Management, then point your registrar at Contabo's nameservers:

  • ns1.contabo.net
  • ns2.contabo.net
  • ns3.contabo.net

Until that change is made at the registrar, the zone you edited is not the one the internet reads.

Step 3 · Verify in AYAsec

Go back to AYAsec and click Verify Now. It shows Verifying… while the check runs. Allow a few minutes before retrying if the first attempt does not succeed.

Check the Contabo record yourself

This matters more here than with other providers, because it answers the nameserver question at the same time:

dig TXT _ayasec-verified.yourdomain.com +short

On Windows:

nslookup -type=TXT _ayasec-verified.yourdomain.com

If your token appears, the record is live and served - and Contabo is indeed your DNS. If nothing appears after several minutes, the most likely explanation is that the domain is answered by a different provider.

If Contabo verification fails

What you see - What it usually means - Fix

Record not found - The domain is served by another provider - Check nameservers at your registrar and add the record there

Record not found, nameservers are Contabo - Not published yet, or the name is wrong - Wait a few minutes, then check the name reads _ayasec-verified

Token doesn't match - Extra characters in the value - Re-copy from AYAsec. Check for a trailing space

Timed out - Temporary lookup problem - Wait a minute and retry

Don't have Contabo access?

Most people verifying a domain do not administer its DNS. Forward this:

Hi - I'm setting up AYAsec to monitor our external attack surface, and it needs proof that we control the domain before it will scan anything.

Could you add one DNS record wherever our domain's DNS is hosted?

Type: TXT

Name: _ayasec-verified

Value: ayasec-verification=

It's read-only proof of ownership - it doesn't change how the domain behaves and doesn't affect mail or the website. It can be removed after AYAsec verifies it - AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you. Thanks.

Note that this message does not name a provider, because with Contabo the DNS is often somewhere else. Whoever manages it will know where.

Other ways to verify

If you cannot edit DNS, AYAsec accepts two alternatives:

  • File upload - a text file containing your token at https://yourdomain.com/.well-known/ayasec-verified.txt
  • Meta tag - on your homepage

Both prove the same thing. If your site runs on a Contabo server you control, the file method is often the fastest route here - you can place the file yourself without touching DNS at all.

Using a different DNS provider?

The record is identical everywhere; only the interface changes. See the guides for Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, DigitalOcean, GoDaddy and Hetzner.

Once the domain is verified, Discovery and the first scan take a few minutes.

Run your first scan